GETTING PAID: MERCHANT UNDERWRITING FOR A CASH-PAY METABOLIC PRACTICENobody in this category writes about payments, which is unfortunate, because a frozen merchant account stops a cash-pay practice faster than any marketing problem ever will.

Educational overview · Approx. 12 min read · illustrative, not advice

Nobody in this category writes about payments, which is unfortunate, because a frozen merchant account stops a cash-pay practice faster than any marketing problem ever will.

Why an underwriter sees the category before it sees you

When you apply for a merchant account, a human being at an acquiring bank reads your file against a risk framework that already has an opinion about your industry. That opinion was formed by other merchants, and you inherit it.

Under the Visa Integrity Risk Program, which replaced the Global Brand Protection Program on 1 May 2023, certain business types are designated high integrity risk and the acquirer must maintain specific controls and oversight. Tier 1 — the highest — covers categories where illegal activity could cause significant harm to health or safety, and includes pharmacies under merchant category codes 5122 and 5912. Tier 3 covers heightened non-compliance and deceptive-marketing risk, and includes subscription merchants under MCC 5968.

A cash-pay metabolic practice does not sit squarely in either bucket, and that is precisely the problem. It looks like a health practitioner. But if it coordinates medication fulfilment, sells supplements alongside the program, and bills a recurring membership, an underwriter can read pharmacy characteristics and subscription characteristics into the same file. Two of the three tiers now have a claim on you.

Processors publish this. One major processor's public restricted-business list names telemedicine and telehealth services, online pharmacies, card-not-present prescription-only products and pharmaceuticals, prescription-only and regulated medical devices, and prescription delivery services as restricted categories requiring additional due diligence — while prohibiting pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims. Read your prospective processor's list before you apply, not after you are declined.

Your merchant category code matters more than your rate

Founders negotiate hard on basis points and accept whatever MCC the acquirer assigns. That is backwards. The code determines your interchange, whether high-integrity-risk registration applies, what monitoring you fall under, and how fast a risk team escalates when something looks unusual.

Being coded as a nutraceutical or subscription merchant when you are a medical practice with a membership is the most consequential clerical event in your whole setup, and it happens silently. Ask, in writing, which MCC will be assigned and on what basis. Ask what triggers a reclassification. Keep the answer.

This is also where product mix bites. If you resell supplements, the way supplement supply chains work becomes a payments question, not just a sourcing one, because the claims on the label and on your product page are part of what an underwriter is assessing.

Payments-industry publishers report that Visa raised the annual high-risk registration fee to $950 per acquiring provider from 1 April 2024, alongside per-transaction and volume-based assessments. Visa's own fee schedule is not publicly posted, so treat those figures as industry reporting rather than published fact — but expect an acquirer to pass registration costs through to you in some form.

What "high-risk" actually changes

The label is not a moral judgment and it is not fatal. It changes four concrete things.

Approval timeline. You get real underwriting rather than instant approval, which means a human reads your documents and comes back with questions. A complete file moves; an incomplete one sits.

Reserves. An acquirer may hold funds against future disputes and refunds. A rolling reserve withholds a percentage of settled volume and releases it on a lag. A capped reserve accumulates to a fixed ceiling then stops. An upfront reserve is posted at the start. Reserve terms are negotiated per file and are not published anywhere, so never accept "that's standard" as an answer. Get the percentage, the hold period, the release trigger and the review date in writing.

Velocity and volume caps. Accounts are approved for a projected monthly volume and average ticket. Exceeding what you projected does not read as success inside a risk system; it reads as an anomaly, and anomalies get reviewed. If your projection was conservative and your launch outperforms it, tell your acquirer before their monitoring does.

Pricing and personal guarantee. Expect higher pricing than a low-risk retail merchant and expect a personal guarantee. We are not publishing rate percentages here because there is no credible public source for what a specific practice will be quoted, and a made-up number would be worse than silence.

Dispute thresholds are what actually close accounts

Card networks monitor dispute performance against published ratios, and those ratios tightened sharply in 2026.

Visa's Acquirer Monitoring Program moved its merchant excessive threshold to 1.5% on 1 April 2026, per industry reporting of Visa's non-public rules. The VAMP ratio is count-based and applies to card-not-present activity: fraud reports (TC40) plus disputes (TC15), divided by settled transactions. A fraud report that later becomes a dispute counts on both sides of the numerator. A monthly floor of 1,500 combined events applies, and reporting describes per-event fees of $8 with no warning tier.

Mastercard's Excessive Chargeback Merchant program identifies merchants at 100 to 299 chargebacks in a month combined with a ratio of 1.50% to 2.99%; the High Excessive tier begins at 300 chargebacks and a 3.00% ratio. The ratio is calculated as chargebacks received in a given month divided by sales processed in the prior month. Fines escalate over consecutive months, and exiting the program requires staying below threshold for three consecutive months.

Note the denominator on the Mastercard calculation, because it catches young practices. Your ratio uses last month's sales. A slow month raises your ratio even if your dispute count is flat. Combine that with a small base — where five disputes against three hundred transactions is already 1.67% — and you can breach a threshold through arithmetic rather than misconduct.

Why a mainstream processor freezes a young account

Payment aggregators onboard merchants fast because they underwrite at the portfolio level and review individual accounts after the fact. That is a real convenience and a real exposure: the review that did not happen before you started processing happens later, usually at the least convenient moment.

The common triggers are predictable. A step-change in daily volume. The first cluster of disputes. A descriptor members do not recognise. And website copy that reads as a prohibited claim. That last one is worth taking seriously in this specific category: in September 2025 the FDA issued more than 50 warning letters to companies compounding or manufacturing semaglutide and tirzepatide over statements it deemed false or misleading. Risk teams read the same pages regulators do.

Supply-side change is also a payments event. The FDA proposed on 30 April 2026 to exclude semaglutide, tirzepatide and liraglutide from the 503B bulk drug substances list, finding no clinical need and expressly rejecting affordability and insurance access as constituting clinical need, with the comment period extended to 30 July 2026. If your sourcing model changes in response to a rule change, your merchant file changes too, and your acquirer should hear it from you first. The wider posture this sits inside is set out in the compliance basics for wellness businesses and in how Atlas handles regulatory posture.

Recurring billing is where your disputes come from

Most disputes in a membership business are not fraud. They are recognition failures and cancellation failures, and both are design problems you control.

The regulatory backdrop is unsettled and you should not take marketing copy as your guide to it. The FTC's "click-to-cancel" negative option rule was vacated in its entirety by the Eighth Circuit on 8 July 2025, days before full enforcement. The Restore Online Shoppers' Confidence Act, Section 5 of the FTC Act and state auto-renewal statutes continue to apply, and on 11 March 2026 the FTC opened an advance notice of proposed rulemaking on the Negative Option Rule with comments due 13 April 2026. What any of that requires of your specific enrollment flow is a question for your own counsel in your own state.

Operationally, the measures that reduce disputes are unglamorous and cheap: disclose the recurring terms adjacent to the payment button rather than in linked terms; email a receipt that names the next charge date and amount; send a reminder before each renewal charge; offer a cancellation path that does not require a phone call; and use a billing descriptor that matches the brand name on the site the member actually visited. Descriptor mismatch alone generates a meaningful share of "I don't recognise this charge" disputes, which is one more reason owning your brand is an operational asset rather than a vanity one.

The file that shortens underwriting

Underwriters are not deciding whether your business is a good idea. They are deciding whether it is what it claims to be. Assemble the evidence before you apply and the process compresses; assemble it in response to questions and it drags for weeks.

A complete file generally includes:

• Formation documents, EIN letter, and current good standing for every entity in the structure — including the separately licensed medical entity.
• Ownership and beneficial ownership detail with government ID for each principal.
• Three to six months of prior processing statements if any exist, and a bank letter or voided check on the settlement account.
• The medical entity's licensure and the clinician of record's state license, since a health-adjacent file without visible licensure is the fastest route to a decline.
• Documentation of the fulfilment or pharmacy relationship, showing who dispenses and under what authority.
• A refund and cancellation policy that is live on the site and matches what your checkout actually does.
• Terms of service and a privacy policy that reflect the real data flows.
• A finished website: working checkout, real contact information, no placeholder copy, and no efficacy language you cannot support.
• Projected monthly volume and average ticket, with the reasoning behind the projection rather than a round number.
• Your written dispute-handling process, including who responds and within what window.

Never operate on a single processor

The single most common unforced error in this category is running a whole practice through one merchant account because the pricing was good. A freeze is not a payments inconvenience; it is a full stop on collections while your obligations continue.

Underwrite a secondary before you need it. Both accounts live, both underwritten with the same disclosed file, and routing you control rather than routing your gateway controls. Adding a bank-debit rail as a third option is worth evaluating too — different rails carry different dispute regimes and different timelines, which changes your exposure profile rather than just your costs. How that sits inside the wider cost picture belongs with the rest of the unit economics of metabolic care.

PCI scope: the boring requirement that bites

Compliance obligations here are not optional and they changed recently. Under PCI DSS v4.0.1, the future-dated requirements from v4.0 became mandatory on 31 March 2025 — 51 of the 64 new requirements. Separately, in January 2025 the PCI Security Standards Council removed requirements 6.4.3 and 11.6.1 from Self-Assessment Questionnaire A and replaced them with an eligibility criterion: the merchant must confirm the payment page is not susceptible to script attacks, either directly or through written confirmation from a compliant provider.

The practical translation is to keep card data out of your own environment — hosted fields or a redirect — and to keep third-party scripts off the payment page. Every analytics tag and chat widget you add to checkout is a question you will have to answer later.

How this is handled in an Atlas build, and what stays yours

Atlas builds the commercial stack around a partner's own entities. Merchant accounts are opened in the partner's name and belong to the partner, because an account you do not control is a dependency you cannot unwind. Ask Atlas to put this in writing: which processors, gateways and backup rails ship as the default stack in an Atlas build. Atlas provides no medical services and employs no clinicians; clinical operations sit with a separately licensed medical entity. The license fee is one-time. It carries 0% of revenue and no ongoing partner fees. The figure is not published anywhere, by design — it is disclosed in full on the fit call, where it can be put next to what it covers instead of floating on its own..

Payments is one of the places where the difference between a real build and a slide deck shows up immediately, which is why it is worth reading how an Atlas build is actually assembled and pressing on the parts that sound easy. The staffing side of the same operation is covered in who you actually need to hire, and the two are connected: the coordination role you staff is the one that prevents the disputes your merchant account is measured on.

The fit call decides in both directions

Atlas takes a limited number of partner builds. Ask Atlas to put this in writing: partner slots per quarter. The application is a qualification step, not a purchase, and the call ends with a yes or a no from both sides — including ours.

If you want to arrive with harder questions, start with the diligence material and the due diligence checklist, then bring the parts that do not satisfy you to the call. Candidates who interrogate the payments and entity structure are the ones this model works for. Apply here when you are ready.

FREQUENTLY ASKED QUESTIONS.